Data Sources & Attribution
Where the intelligence comes from, what licence each source carries, and what that means for what we can hand out.
AbuseScore is built from data that network operators and security projects publish themselves, combined with our own observations. Nothing here is scraped from behind a login and nothing is bought from a data broker.
Why the licence matters to you
Some of this data carries a share-alike licence: redistributing it forces the same licence onto whatever you built with it. That is fine for answering an API request and fatal for a file you sell. Some of it may not be passed on at all, on any terms.
So the compiler builds two artifacts from the same store. The one that serves the API contains everything. The one available for download contains only sources whose licences permit redistribution, and ships with the attribution notice those licences require. The filter is on the licence recorded against each source, never on a list of names someone has to remember to update.
Open
Public domain, or licensed permissively enough to redistribute freely.
| Source | Published at | What it provides |
|---|---|---|
aws |
ip-ranges.amazonaws.com |
Public IP ranges for every AWS service and region. |
mullvad |
api.mullvad.net |
Entry addresses of every relay Mullvad operates. |
tor_exit |
check.torproject.org |
Addresses currently exiting Tor traffic, published by the Tor Project. |
firehol_level1 |
raw.githubusercontent.com |
FireHOL level 1: dshield, feodo, fullbogons and spamhaus_drop combined. |
Share-alike
Redistribution would force the same licence onto anything derived from it. Used to answer API requests; never included in a downloadable file.
| Source | Published at | What it provides |
|---|---|---|
ipinfo_lite |
ipinfo.io |
Country, continent and ASN for every allocated network. CC-BY-SA — never distributed. |
Redistribution not permitted
The supplier allows us to use it to answer your questions and does not allow us to pass the database on. Used to answer API requests; never included in a downloadable file.
| Source | Published at | What it provides |
|---|---|---|
maxmind_geolite2 |
download.maxmind.com |
Country and continent from MaxMind GeoLite2, the cross-check on IPinfo. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. Redistribution forbidden, so it is never distributed. |
Specific attributions
IPinfo Lite : country, continent and ASN data by IPinfo, licensed under CC BY-SA 4.0.
MaxMind GeoLite2 : this product includes GeoLite2 data created by MaxMind, available from maxmind.com. Its use is governed by the GeoLite End User License Agreement, which does not permit us to redistribute the database, so we do not. It is a second, independent opinion on which country an address sits in, which is the only way to tell when two sources disagree.
The Tor Project : exit node lists published by torproject.org.
Cloud and VPN operators : Amazon Web Services, Mullvad and others publish their own address ranges. Using an operator's own list is why these flags have almost no false positives. It is not inferred, it is declared.
FireHOL : aggregated blocklists from iplists.firehol.org, themselves assembled from DShield, Feodo Tracker, Spamhaus DROP and others under their respective terms.
How evidence ages
A fact is never deleted because a source stopped mentioning it. An address that left today's Tor list was still an exit yesterday, and blocklists drop and re-add the same address constantly. Instead each source has a decay window and its evidence loses weight after it, from a week for fast-moving lists to three months for network allocation data.
That is what stops a stale entry following an address around after it has been reassigned to somebody innocent.
Corrections
If a network you operate is described incorrectly, email [email protected] with the prefix and what is wrong. It is free, you do not need an account, and we do not ask why.
Where the entry came from a third-party list we will tell you which one, because we cannot change what somebody else publishes. We can stop weighting it, though, and we will if it is wrong.